There are a lot of things to say about this (for instance, I'm not sure policies should be constructed based on the worst thing that could happen instead of the

There are a lot of things to say about this (for instance, I'm not sure policies should be constructed based on the worst thing that could happen instead of the thing that probably will happen), but this leaps out at me: Why would a terrorist _pretend_ to be a student. Why not be an actual student? They aren't mutually exclusive, and it doesn't even feel like pretending would save a lot of time.